CVE-2026-116675

A flaw was found in TinyMCE. The media plugin creates elements in the active document before input sanitization occurs. An attacker can exploit this vulnerability by injecting specially crafted media attributes into a document, resulting in stored cross-site scripting XSS. When another user views...